# Plotting dionaea's statistics with gnuplot

Introduction

Dionaea
Gnuplot
SQLite

Execution

# cat sqlite.query
select
 strftime('%Y-%m-%d',c.connection_timestamp,'unixepoch','localtime') as date,
 count(distinct c.connection), count(distinct d.connection)
from connections c
left outer join downloads d
on (c.connection==d.connection)
group by date
order by date asc;
# sqlite3 /opt/dionaea/var/dionaea/logsql.sqlite
sqlite> .output data.txt
sqlite> .read sqlite.query
sqlite> .exit
# cat data.txt
2011-02-10|125|11
2011-02-11|541|9
2011-02-12|1487|6
2011-02-13|207|5
2011-02-14|611|11
2011-02-15|99|10
2011-02-16|131|12
2011-02-17|128|12
# apt-get install gnuplot
# gnuplot
gnuplot> set terminal png size 640,480 nocrop butt font \
> "/usr/share/fonts/truetype/ttf-liberation/LiberationSans-Regular.ttf"
gnuplot> set output "dionaea.png"
gnuplot> set xdata time
gnuplot> set timefmt "%Y-%m-%d"
gnuplot> set format x "%b %d"
gnuplot> set ylabel "attacks"
gnuplot> set y2label "binaries"
gnuplot> set y2tics
gnuplot> set datafile separator "|"
gnuplot> plot "./data.txt" using 1:2 title "attacks" with lines,\
> "./data.txt" using 1:3 title "binaries" with lines axes x1y2
gnuplot> exit
# eog dionaea.png

# Instalar dionaea

Información

Dionaea

Instalación

# cat /etc/lsb-release | grep DESC
DISTRIB_DESCRIPTION="Ubuntu 10.10"
# cd
# ### Some packages
# apt-get install libudns-dev \
libglib2.0-dev \
libssl-dev \
libcurl4-openssl-dev \
libreadline-dev \
libsqlite3-dev \
python-dev \
libtool \
automake \
autoconf \
build-essential \
subversion \
git-core \
flex \
bison \
pkg-config
# mkdir /opt/dionaea
# mkdir dionaea
# cd dionaea
# ### liblcfg
# git clone git://git.carnivore.it/liblcfg.git liblcfg
# cd liblcfg/code
# autoreconf -vi
# ./configure --prefix=/opt/dionaea
# make install
# cd ..
# cd ..
# ### libemu
# git clone git://git.carnivore.it/libemu.git libemu
# cd libemu
# autoreconf -vi
# ./configure --prefix=/opt/dionaea
# make install
# cd ..
# ### libev
# wget http://dist.schmorp.de/libev/Attic/libev-3.9.tar.gz
# tar xfz libev-3.9.tar.gz
# cd libev-3.9
# ./configure --prefix=/opt/dionaea
# make install
# cd ..
# ### cython
# wget http://cython.org/release/Cython-0.12.1.tar.gz
# tar xfz Cython-0.12.1.tar.gz
# cd Cython-0.12.1       
# python setup.py build
# sudo python setup.py install
# cd ..
# ### sqlite3
# apt-get install sqlite3
# ### python3
# wget http://python.org/ftp/python/3.1.2/Python-3.1.2.tgz
# tar xfz Python-3.1.2.tgz
# cd Python-3.1.2
# ./configure --enable-shared \
--prefix=/opt/dionaea \
--with-computed-gotos \
--enable-ipv6 \
LDFLAGS="-Wl,-rpath=/opt/dionaea/lib/"
# make
# make install
# cd ..
# ### libxml2
# apt-get install libxml2-dev
# ### libxslt
# apt-get install libxslt1-dev
# ### lxml
# wget http://codespeak.net/lxml/lxml-2.2.6.tgz
# tar xfz lxml-2.2.6.tgz
# cd lxml-2.2.6
# /opt/dionaea/bin/2to3 -w src/lxml/html/_diffcommand.py
# /opt/dionaea/bin/2to3 -w src/lxml/html/_html5builder.py
# /opt/dionaea/bin/python3 setup.py build
# /opt/dionaea/bin/python3 setup.py install
# cd ..
# ### c-ares
# wget http://c-ares.haxx.se/c-ares-1.7.3.tar.gz
# tar xfz c-ares-1.7.3.tar.gz
# cd c-ares-1.7.3
# ./configure --prefix=/opt/dionaea
# make
# make install
# cd ..
# ### curl
# wget http://curl.haxx.se/download/curl-7.20.0.tar.bz2
# tar xfj curl-7.20.0.tar.bz2
# cd curl-7.20.0
# ./configure --prefix=/opt/dionaea --enable-ares=/opt/dionaea
# make
# make install
# cd ..
# ### libpcap
# wget http://www.tcpdump.org/release/libpcap-1.1.1.tar.gz
# tar xfz libpcap-1.1.1.tar.gz
# cd libpcap-1.1.1
# ./configure --prefix=/opt/dionaea
# make
# make install
# cd ..
# ### p0f
# apt-get install p0f
# ### dionaea
# git clone git://git.carnivore.it/dionaea.git dionaea
# cd dionaea
# autoreconf -vi
# ./configure --with-lcfg-include=/opt/dionaea/include/ \
--with-lcfg-lib=/opt/dionaea/lib/ \
--with-python=/opt/dionaea/bin/python3.1 \
--with-cython-dir=/usr/local/bin \
--with-udns-include=/opt/dionaea/include/ \
--with-udns-lib=/opt/dionaea/lib/ \
--with-emu-include=/opt/dionaea/include/ \
--with-emu-lib=/opt/dionaea/lib/ \
--with-gc-include=/usr/include/gc \
--with-ev-include=/opt/dionaea/include \
--with-ev-lib=/opt/dionaea/lib \
--with-nl-include=/opt/dionaea/include \
--with-nl-lib=/opt/dionaea/lib/ \
--with-curl-config=/opt/dionaea/bin/ \
--with-pcap-include=/opt/dionaea/include \
--with-pcap-lib=/opt/dionaea/lib/ \
--with-glib=/opt/dionaea
# make
# make install
# cd ..

Configuración

# cd /opt/dionaea/etc/dionaea
# sed -i 's/^\/\/\t\t\t"p0f"/\t\t\t"p0f"/' dionaea.conf

Ejecución

# cd /opt/dionaea/bin/
# p0f -i any -u root -Q /tmp/p0f.sock -q -l -d -o /tmp/p0f.log
# ./dionaea -l all,-debug -L '*' -D

Visualización

# cd /opt/dionaea/var/dionaea
# sqlite3 logsql.sqlite
sqlite> select count(local_port), local_port
FROM connections
where connection_type='accept'
group by local_port;
9|135
4|445
2|1433
sqlite> .exit